Create userdom_user_tmp_content, and replace existing user tmp content type declarations by it.

Signed-off-by Dominick Grift<[email protected]>

---
:100644 100644 f294491... b1aeb7c... M policy/modules/apps/evolution.te
:100644 100644 ac4f509... cea5c8c... M policy/modules/apps/games.te
:100644 100644 4bebd9d... de7eac9... M policy/modules/apps/gnome.te
:100644 100644 4525c37... c6f1fe2... M policy/modules/apps/gpg.te
:100644 100644 66beb80... 29c9f53... M policy/modules/apps/irc.te
:100644 100644 726e853... 143a522... M policy/modules/apps/java.te
:100644 100644 ebcd681... 3fb62e4... M policy/modules/apps/mozilla.te
:100644 100644 690589e... 892057b... M policy/modules/apps/podsleuth.te
:100644 100644 320df26... 55e29cb... M policy/modules/apps/screen.if
:100644 100644 8c65cc6... a92649b... M policy/modules/apps/screen.te
:100644 100644 d736572... 10d6692... M policy/modules/apps/tvtime.te
:100644 100644 2df1343... 62960c0... M policy/modules/apps/uml.te
:100644 100644 1f803bb... 5bc77b4... M policy/modules/apps/vmware.te
:100644 100644 8af45db... 2835bec... M policy/modules/apps/wine.te
:100644 100644 31bbf17... ca29f80... M policy/modules/apps/wireshark.te
:100644 100644 215b86b... 1d6ddf2... M policy/modules/services/bluetooth.te
:100644 100644 44caccc... 80c88c1... M policy/modules/services/cron.if
:100644 100644 d76131b... 054d8b3... M policy/modules/services/dbus.if
:100644 100644 b738e94... 319e41e... M policy/modules/services/dbus.te
:100644 100644 93c14ca... a2c91f2... M policy/modules/services/lpd.te
:100644 100644 c57356a... 9d3ef86... M policy/modules/services/mta.if
:100644 100644 64268e4... b1111b2... M policy/modules/services/mta.te
:100644 100644 cd683f9... 2b30c50... M policy/modules/services/pyzor.te
:100644 100644 e4ecbbd... ab30865... M policy/modules/services/razor.te
:100644 100644 b6a8919... 6847a9b... M policy/modules/services/spamassassin.te
:100644 100644 567592d... ef3f32d... M policy/modules/services/ssh.if
:100644 100644 2dad3c8... 512834a... M policy/modules/services/ssh.te
:100644 100644 d2b2626... f51b828... M policy/modules/services/xserver.te
:100644 100644 a3135e6... 7d83ec3... M policy/modules/system/userdomain.if
:100644 100644 69b2e0f... 5dcefd4... M policy/modules/system/userdomain.te

  policy/modules/apps/evolution.te        |   13 +++++--------
  policy/modules/apps/games.te            |    3 +--
  policy/modules/apps/gnome.te            |    3 +--
  policy/modules/apps/gpg.te              |    6 ++----
  policy/modules/apps/irc.te              |    2 +-
  policy/modules/apps/java.te             |    3 +--
  policy/modules/apps/mozilla.te          |    3 +--
  policy/modules/apps/podsleuth.te        |    3 +--
  policy/modules/apps/screen.if           |    2 ++
  policy/modules/apps/screen.te           |    2 --
  policy/modules/apps/tvtime.te           |    3 +--
  policy/modules/apps/uml.te              |    3 +--
  policy/modules/apps/vmware.te           |    7 +++----
  policy/modules/apps/wine.te             |    3 +--
  policy/modules/apps/wireshark.te        |    3 +--
  policy/modules/services/bluetooth.te    |    3 +--
  policy/modules/services/cron.if         |    2 +-
  policy/modules/services/dbus.if         |    2 ++
  policy/modules/services/dbus.te         |    2 --
  policy/modules/services/lpd.te          |    3 +--
  policy/modules/services/mta.if          |    3 ++-
  policy/modules/services/mta.te          |    2 --
  policy/modules/services/pyzor.te        |    3 +--
  policy/modules/services/razor.te        |    3 +--
  policy/modules/services/spamassassin.te |    6 ++----
  policy/modules/services/ssh.if          |    2 ++
  policy/modules/services/ssh.te          |    2 --
  policy/modules/services/xserver.te      |    6 ++----
  policy/modules/system/userdomain.if     |   24 ++++++++++++++++++++++++
  policy/modules/system/userdomain.te     |    1 +
  30 files changed, 62 insertions(+), 61 deletions(-)

policy/modules/apps/evolution.te +5 -8

index f294491..b1aeb7c 100644
@@ -28,8 +28,7 @@ ubac_constrained(evolution_alarm_tmpfs_t)
  type evolution_alarm_orbit_tmp_t;
  typealias evolution_alarm_orbit_tmp_t alias { user_evolution_alarm_orbit_tmp_t staff_evolution_alarm_orbit_tmp_t sysadm_evolution_alarm_orbit_tmp_t };
  typealias evolution_alarm_orbit_tmp_t alias { auditadm_evolution_alarm_orbit_tmp_t secadm_evolution_alarm_orbit_tmp_t };
-files_tmp_file(evolution_alarm_orbit_tmp_t)
-ubac_constrained(evolution_alarm_orbit_tmp_t)
+userdom_user_tmp_content(evolution_alarm_t, evolution_alarm_orbit_tmp_t)
 
  type evolution_exchange_t;
  type evolution_exchange_exec_t;

@@ -47,9 +46,9 @@ ubac_constrained(evolution_exchange_tmpfs_t)
  type evolution_exchange_tmp_t;
  typealias evolution_exchange_tmp_t alias { user_evolution_exchange_tmp_t staff_evolution_exchange_tmp_t sysadm_evolution_exchange_tmp_t };
  typealias evolution_exchange_tmp_t alias { auditadm_evolution_exchange_tmp_t secadm_evolution_exchange_tmp_t };
-files_tmp_file(evolution_exchange_tmp_t)
-ubac_constrained(evolution_exchange_tmp_t)
+userdom_user_tmp_content(evolution_exchange_t, evolution_exchange_tmp_t)
 
+# Cannot have two types of the same domain be a files_poly_member_tmp()
  type evolution_exchange_orbit_tmp_t;
  typealias evolution_exchange_orbit_tmp_t alias { user_evolution_exchange_orbit_tmp_t staff_evolution_exchange_orbit_tmp_t sysadm_evolution_exchange_orbit_tmp_t };
  typealias evolution_exchange_orbit_tmp_t alias { auditadm_evolution_exchange_orbit_tmp_t secadm_evolution_exchange_orbit_tmp_t };

@@ -64,8 +63,7 @@ userdom_user_home_content(evolution_home_t)
  type evolution_orbit_tmp_t;
  typealias evolution_home_t alias { user_evolution_orbit_tmp_t staff_evolution_orbit_tmp_t sysadm_evolution_orbit_tmp_t };
  typealias evolution_home_t alias { auditadm_evolution_orbit_tmp_t secadm_evolution_orbit_tmp_t };
-files_tmp_file(evolution_orbit_tmp_t)
-ubac_constrained(evolution_orbit_tmp_t)
+userdom_user_tmp_content(evolution_t, evolution_orbit_tmp_t)
 
  type evolution_server_t;
  type evolution_server_exec_t;

@@ -77,8 +75,7 @@ ubac_constrained(evolution_server_t)
  type evolution_server_orbit_tmp_t;
  typealias evolution_server_orbit_tmp_t alias { user_evolution_server_orbit_tmp_t staff_evolution_server_orbit_tmp_t sysadm_evolution_server_orbit_tmp_t };
  typealias evolution_server_orbit_tmp_t alias { auditadm_evolution_server_orbit_tmp_t secadm_evolution_server_orbit_tmp_t };
-files_tmp_file(evolution_server_orbit_tmp_t)
-ubac_constrained(evolution_server_orbit_tmp_t)
+userdom_user_tmp_content(evolution_server_t, evolution_server_orbit_tmp_t)
 
  type evolution_tmpfs_t;
  typealias evolution_tmpfs_t alias { user_evolution_tmpfs_t staff_evolution_tmpfs_t sysadm_evolution_tmpfs_t };

policy/modules/apps/games.te +1 -2

index ac4f509..cea5c8c 100644
@@ -35,8 +35,7 @@ files_pid_file(games_srv_var_run_t)
  type games_tmp_t;
  typealias games_tmp_t alias { user_games_tmp_t staff_games_tmp_t sysadm_games_tmp_t };
  typealias games_tmp_t alias { auditadm_games_tmp_t secadm_games_tmp_t };
-files_tmp_file(games_tmp_t)
-ubac_constrained(games_tmp_t)
+userdom_user_tmp_content(games_t, games_tmp_t)
 
  type games_tmpfs_t;
  typealias games_tmpfs_t alias { user_games_tmpfs_t staff_games_tmpfs_t sysadm_games_tmpfs_t };

policy/modules/apps/gnome.te +1 -2

index 4bebd9d..de7eac9 100644
@@ -18,8 +18,7 @@ userdom_user_home_content(gconf_home_t)
  type gconf_tmp_t;
  typealias gconf_tmp_t alias { user_gconf_tmp_t staff_gconf_tmp_t sysadm_gconf_tmp_t };
  typealias gconf_tmp_t alias { auditadm_gconf_tmp_t secadm_gconf_tmp_t };
-files_tmp_file(gconf_tmp_t)
-ubac_constrained(gconf_tmp_t)
+userdom_user_tmp_content(gconfd_t, gconf_tmp_t)
 
  type gconfd_t, gnomedomain;
  type gconfd_exec_t;

policy/modules/apps/gpg.te +2 -4

index 4525c37..c6f1fe2 100644
@@ -31,8 +31,7 @@ ubac_constrained(gpg_agent_t)
  type gpg_agent_tmp_t;
  typealias gpg_agent_tmp_t alias { user_gpg_agent_tmp_t staff_gpg_agent_tmp_t sysadm_gpg_agent_tmp_t };
  typealias gpg_agent_tmp_t alias { auditadm_gpg_agent_tmp_t secadm_gpg_agent_tmp_t };
-files_tmp_file(gpg_agent_tmp_t)
-ubac_constrained(gpg_agent_tmp_t)
+userdom_user_tmp_content(gpg_agent_t, gpg_agent_tmp_t)
 
  type gpg_secret_t;
  typealias gpg_secret_t alias { user_gpg_secret_t staff_gpg_secret_t sysadm_gpg_secret_t };

@@ -55,8 +54,7 @@ application_domain(gpg_pinentry_t, pinentry_exec_t)
  ubac_constrained(gpg_pinentry_t)
 
  type gpg_pinentry_tmp_t;
-files_tmp_file(gpg_pinentry_tmp_t)
-ubac_constrained(gpg_pinentry_tmp_t)
+userdom_user_tmp_content(gpg_pinentry_t, gpg_pinentry_tmp_t)
 
  type gpg_pinentry_tmpfs_t;
  files_tmpfs_file(gpg_pinentry_tmpfs_t)

policy/modules/apps/irc.te +1 -1

index 66beb80..29c9f53 100644
@@ -20,7 +20,7 @@ userdom_user_home_content(irc_home_t)
  type irc_tmp_t;
  typealias irc_tmp_t alias { user_irc_tmp_t staff_irc_tmp_t sysadm_irc_tmp_t };
  typealias irc_tmp_t alias { auditadm_irc_tmp_t secadm_irc_tmp_t };
-userdom_user_home_content(irc_tmp_t)
+userdom_user_tmp_content(irc_t, irc_tmp_t)
 
  ########################################
  #

policy/modules/apps/java.te +1 -2

index 726e853..143a522 100644
@@ -21,10 +21,9 @@ typealias java_t alias { auditadm_javaplugin_t secadm_javaplugin_t };
  role system_r types java_t;
 
  type java_tmp_t;
-files_tmp_file(java_tmp_t)
-ubac_constrained(java_tmp_t)
  typealias java_tmp_t alias { staff_javaplugin_tmp_t user_javaplugin_tmp_t sysadm_javaplugin_tmp_t };
  typealias java_tmp_t alias { auditadm_tmp_javaplugin_t secadm_javaplugin_tmp_t };
+userdom_user_tmp_content(java_t, java_tmp_t)
 
  type java_tmpfs_t;
  ubac_constrained(java_tmpfs_t)

policy/modules/apps/mozilla.te +1 -2

index ebcd681..3fb62e4 100644
@@ -30,8 +30,7 @@ userdom_user_home_content(mozilla_home_t)
  type mozilla_tmpfs_t;
  typealias mozilla_tmpfs_t alias { user_mozilla_tmpfs_t staff_mozilla_tmpfs_t sysadm_mozilla_tmpfs_t };
  typealias mozilla_tmpfs_t alias { auditadm_mozilla_tmpfs_t secadm_mozilla_tmpfs_t };
-files_tmpfs_file(mozilla_tmpfs_t)
-ubac_constrained(mozilla_tmpfs_t)
+userdom_user_tmp_content(mozilla_t, mozilla_tmpfs_t)
 
  ########################################
  #

policy/modules/apps/podsleuth.te +1 -2

index 690589e..892057b 100644
@@ -15,8 +15,7 @@ files_type(podsleuth_cache_t)
  ubac_constrained(podsleuth_cache_t)
 
  type podsleuth_tmp_t;
-files_tmp_file(podsleuth_tmp_t)
-ubac_constrained(podsleuth_tmp_t)
+userdom_user_tmp_content(podsleuth_t, podsleuth_tmp_t)
 
  type podsleuth_tmpfs_t;
  files_tmpfs_file(podsleuth_tmpfs_t)

policy/modules/apps/screen.if +2 -0

index 320df26..55e29cb 100644
@@ -38,6 +38,8 @@ template(`screen_role_template',`
  	ubac_constrained($1_screen_t)
  	role $2 types $1_screen_t;
 
+	userdom_user_tmp_content($1_screen_t, screen_tmp_t)
+
  	########################################
  	#
  	# Local policy

policy/modules/apps/screen.te +0 -2

index 8c65cc6..a92649b 100644
@@ -16,8 +16,6 @@ userdom_user_home_content(screen_home_t)
  type screen_tmp_t;
  typealias screen_tmp_t alias { user_screen_tmp_t staff_screen_tmp_t sysadm_screen_tmp_t };
  typealias screen_tmp_t alias { auditadm_screen_tmp_t secadm_screen_tmp_t };
-files_tmp_file(screen_tmp_t)
-ubac_constrained(screen_tmp_t)
 
  type screen_var_run_t;
  typealias screen_var_run_t alias { user_screen_var_run_t staff_screen_var_run_t sysadm_screen_var_run_t };

policy/modules/apps/tvtime.te +1 -2

index d736572..10d6692 100644
@@ -20,8 +20,7 @@ userdom_user_home_content(tvtime_home_t)
  type tvtime_tmp_t;
  typealias tvtime_tmp_t alias { user_tvtime_tmp_t staff_tvtime_tmp_t sysadm_tvtime_tmp_t };
  typealias tvtime_tmp_t alias { auditadm_tvtime_tmp_t secadm_tvtime_tmp_t };
-files_tmp_file(tvtime_tmp_t)
-ubac_constrained(tvtime_tmp_t)
+userdom_user_tmp_content(tvtime_t, tvtime_tmp_t)
 
  type tvtime_tmpfs_t;
  typealias tvtime_tmpfs_t alias { user_tvtime_tmpfs_t staff_tvtime_tmpfs_t sysadm_tvtime_tmpfs_t };

policy/modules/apps/uml.te +1 -2

index 2df1343..62960c0 100644
@@ -25,8 +25,7 @@ userdom_user_home_content(uml_rw_t)
  type uml_tmp_t;
  typealias uml_tmp_t alias { user_uml_tmp_t staff_uml_tmp_t sysadm_uml_tmp_t };
  typealias uml_tmp_t alias { auditadm_uml_tmp_t secadm_uml_tmp_t };
-files_tmp_file(uml_tmp_t)
-ubac_constrained(uml_tmp_t)
+userdom_user_tmp_content(uml_t, uml_tmp_t)
 
  type uml_tmpfs_t;
  typealias uml_tmpfs_t alias { user_uml_tmpfs_t staff_uml_tmpfs_t sysadm_uml_tmpfs_t };

policy/modules/apps/vmware.te +3 -4

index 1f803bb..5bc77b4 100644
@@ -31,15 +31,15 @@ init_daemon_domain(vmware_host_t, vmware_host_exec_t)
  type vmware_host_pid_t alias vmware_var_run_t;
  files_pid_file(vmware_host_pid_t)
 
+# If vmware_host_t is a system service then why does this have to be ubac constrained?
  type vmware_host_tmp_t;
  files_tmp_file(vmware_host_tmp_t)
-ubac_constrained(vmware_host_tmp_t)
 
+# If vmware_host_t is a system service then why does this have to be ubac constrained?
  type vmware_log_t;
  typealias vmware_log_t alias { user_vmware_log_t staff_vmware_log_t sysadm_vmware_log_t };
  typealias vmware_log_t alias { auditadm_vmware_log_t secadm_vmware_log_t };
  logging_log_file(vmware_log_t)
-ubac_constrained(vmware_log_t)
 
  type vmware_pid_t;
  typealias vmware_pid_t alias { user_vmware_pid_t staff_vmware_pid_t sysadm_vmware_pid_t };

@@ -54,8 +54,7 @@ files_type(vmware_sys_conf_t)
  type vmware_tmp_t;
  typealias vmware_tmp_t alias { user_vmware_tmp_t staff_vmware_tmp_t sysadm_vmware_tmp_t };
  typealias vmware_tmp_t alias { auditadm_vmware_tmp_t secadm_vmware_tmp_t };
-files_tmp_file(vmware_tmp_t)
-ubac_constrained(vmware_tmp_t)
+userdom_user_tmp_content(vmware_t, vmware_tmp_t)
 
  type vmware_tmpfs_t;
  typealias vmware_tmpfs_t alias { user_vmware_tmpfs_t staff_vmware_tmpfs_t sysadm_vmware_tmpfs_t };

policy/modules/apps/wine.te +1 -2

index 8af45db..2835bec 100644
@@ -12,8 +12,7 @@ ubac_constrained(wine_t)
  role system_r types wine_t;
 
  type wine_tmp_t;
-files_tmp_file(wine_tmp_t)
-ubac_constrained(wine_tmp_t)
+userdom_user_tmp_content(wine_t, wine_tmp_t)
 
  ########################################
  #

policy/modules/apps/wireshark.te +1 -2

index 31bbf17..ca29f80 100644
@@ -20,8 +20,7 @@ userdom_user_home_content(wireshark_home_t)
  type wireshark_tmp_t;
  typealias wireshark_tmp_t alias { user_wireshark_tmp_t staff_wireshark_tmp_t sysadm_wireshark_tmp_t };
  typealias wireshark_tmp_t alias { auditadm_wireshark_tmp_t secadm_wireshark_tmp_t };
-files_tmp_file(wireshark_tmp_t)
-ubac_constrained(wireshark_tmp_t)
+userdom_user_tmp_content(wireshark_t, wireshark_tmp_t)
 
  type wireshark_tmpfs_t;
  typealias wireshark_tmpfs_t alias { user_wireshark_tmpfs_t staff_wireshark_tmpfs_t sysadm_wireshark_tmpfs_t };

policy/modules/services/bluetooth.te +1 -2

index 215b86b..1d6ddf2 100644
@@ -24,8 +24,7 @@ ubac_constrained(bluetooth_helper_t)
  type bluetooth_helper_tmp_t;
  typealias bluetooth_helper_tmp_t alias { user_bluetooth_helper_tmp_t staff_bluetooth_helper_tmp_t sysadm_bluetooth_helper_tmp_t };
  typealias bluetooth_helper_tmp_t alias { auditadm_bluetooth_helper_tmp_t secadm_bluetooth_helper_tmp_t };
-files_tmp_file(bluetooth_helper_tmp_t)
-ubac_constrained(bluetooth_helper_tmp_t)
+userdom_user_tmp_content(bluetooth_helper_t, bluetooth_helper_tmp_t)
 
  type bluetooth_helper_tmpfs_t;
  typealias bluetooth_helper_tmpfs_t alias { user_bluetooth_helper_tmpfs_t staff_bluetooth_helper_tmpfs_t sysadm_bluetooth_helper_tmpfs_t };

policy/modules/services/cron.if +1 -1

index 44caccc..80c88c1 100644
@@ -22,7 +22,7 @@ template(`cron_common_crontab_template',`
  	ubac_constrained($1_t)
 
  	type $1_tmp_t;
-	files_tmp_file($1_tmp_t)
+	userdom_user_tmp_content($1_t, $1_tmp_t)
 
  	##############################
  	#

policy/modules/services/dbus.if +2 -0

index d76131b..054d8b3 100644
@@ -57,6 +57,8 @@ template(`dbus_role_template',`
  	ubac_constrained($1_dbusd_t)
  	role $2 types $1_dbusd_t;
 
+	userdom_user_tmp_content($1_dbusd_t, session_dbusd_tmp_t)
+
  	##############################
  	#
  	# Local policy

policy/modules/services/dbus.te +0 -2

index b738e94..319e41e 100644
@@ -22,8 +22,6 @@ typealias dbusd_exec_t alias system_dbusd_exec_t;
  type session_dbusd_tmp_t;
  typealias session_dbusd_tmp_t alias { user_dbusd_tmp_t staff_dbusd_tmp_t sysadm_dbusd_tmp_t };
  typealias session_dbusd_tmp_t alias { auditadm_dbusd_tmp_t secadm_dbusd_tmp_t };
-files_tmp_file(session_dbusd_tmp_t)
-ubac_constrained(session_dbusd_tmp_t)
 
  type system_dbusd_t;
  init_system_domain(system_dbusd_t, dbusd_exec_t)

policy/modules/services/lpd.te +1 -2

index 93c14ca..a2c91f2 100644
@@ -40,8 +40,7 @@ ubac_constrained(lpr_t)
  type lpr_tmp_t;
  typealias lpr_tmp_t alias { user_lpr_tmp_t staff_lpr_tmp_t sysadm_lpr_tmp_t };
  typealias lpr_tmp_t alias { auditadm_lpr_tmp_t secadm_lpr_tmp_t };
-files_tmp_file(lpr_tmp_t)
-ubac_constrained(lpr_tmp_t)
+userdom_user_tmp_content(lpr_t, lpr_tmp_t)
 
  # Type for spool files.
  type print_spool_t;

policy/modules/services/mta.if +2 -1

index c57356a..9d3ef86 100644
@@ -52,9 +52,10 @@ template(`mta_base_mail_template',`
 
  	type $1_mail_t, user_mail_domain;
  	application_domain($1_mail_t, sendmail_exec_t)
+	ubac_constrained($1_mail_t)
 
  	type $1_mail_tmp_t;
-	files_tmp_file($1_mail_tmp_t)
+	userdom_user_tmp_content($1_mail_t, $1_mail_tmp_t)
 
  	##############################
  	#

policy/modules/services/mta.te +0 -2

index 64268e4..b1111b2 100644
@@ -40,8 +40,6 @@ typealias user_mail_t alias { staff_mail_t sysadm_mail_t };
  typealias user_mail_t alias { auditadm_mail_t secadm_mail_t };
  typealias user_mail_tmp_t alias { staff_mail_tmp_t sysadm_mail_tmp_t };
  typealias user_mail_tmp_t alias { auditadm_mail_tmp_t secadm_mail_tmp_t };
-ubac_constrained(user_mail_t)
-ubac_constrained(user_mail_tmp_t)
 
  ########################################
  #

policy/modules/services/pyzor.te +1 -2

index cd683f9..2b30c50 100644
@@ -24,8 +24,7 @@ userdom_user_home_content(pyzor_home_t)
  type pyzor_tmp_t;
  typealias pyzor_tmp_t alias { user_pyzor_tmp_t staff_pyzor_tmp_t sysadm_pyzor_tmp_t };
  typealias pyzor_tmp_t alias { auditadm_pyzor_tmp_t secadm_pyzor_tmp_t };
-files_tmp_file(pyzor_tmp_t)
-ubac_constrained(pyzor_tmp_t)
+userdom_user_tmp_content(pyzor_t, pyzor_tmp_t)
 
  type pyzor_var_lib_t;
  typealias pyzor_var_lib_t alias { user_pyzor_var_lib_t staff_pyzor_var_lib_t sysadm_pyzor_var_lib_t };

policy/modules/services/razor.te +1 -2

index e4ecbbd..ab30865 100644
@@ -22,8 +22,7 @@ logging_log_file(razor_log_t)
  type razor_tmp_t;
  typealias razor_tmp_t alias { user_razor_tmp_t staff_razor_tmp_t sysadm_razor_tmp_t };
  typealias razor_tmp_t alias { auditadm_razor_tmp_t secadm_razor_tmp_t };
-files_tmp_file(razor_tmp_t)
-ubac_constrained(razor_tmp_t)
+userdom_user_tmp_content(razor_t, razor_tmp_t)
 
  type razor_var_lib_t;
  files_type(razor_var_lib_t)

policy/modules/services/spamassassin.te +2 -4

index b6a8919..6847a9b 100644
@@ -34,8 +34,7 @@ userdom_user_home_content(spamassassin_home_t)
  type spamassassin_tmp_t;
  typealias spamassassin_tmp_t alias { user_spamassassin_tmp_t staff_spamassassin_tmp_t sysadm_spamassassin_tmp_t };
  typealias spamassassin_tmp_t alias { auditadm_spamassassin_tmp_t secadm_spamassassin_tmp_t };
-files_tmp_file(spamassassin_tmp_t)
-ubac_constrained(spamassassin_tmp_t)
+userdom_user_tmp_content(spamassassin_t, spamassassin_tmp_t)
 
  type spamc_t;
  type spamc_exec_t;

@@ -47,8 +46,7 @@ ubac_constrained(spamc_t)
  type spamc_tmp_t;
  typealias spamc_tmp_t alias { user_spamc_tmp_t staff_spamc_tmp_t sysadm_spamc_tmp_t };
  typealias spamc_tmp_t alias { auditadm_spamc_tmp_t secadm_spamc_tmp_t };
-files_tmp_file(spamc_tmp_t)
-ubac_constrained(spamc_tmp_t)
+userdom_user_tmp_content(spamc_t, spamc_tmp_t)
 
  type spamd_t;
  type spamd_exec_t;

policy/modules/services/ssh.if +2 -0

index 567592d..ef3f32d 100644
@@ -313,6 +313,8 @@ template(`ssh_role_template',`
  	ubac_constrained($1_ssh_agent_t)
  	role $2 types $1_ssh_agent_t;
 
+	userdom_user_tmp_content($1_ssh_agent_t, ssh_agent_tmp_t)
+
  	##############################
  	#
  	# Local policy

policy/modules/services/ssh.te +0 -2

index 2dad3c8..512834a 100644
@@ -57,8 +57,6 @@ corecmd_executable_file(ssh_agent_exec_t)
  type ssh_agent_tmp_t;
  typealias ssh_agent_tmp_t alias { user_ssh_agent_tmp_t staff_ssh_agent_tmp_t sysadm_ssh_agent_tmp_t };
  typealias ssh_agent_tmp_t alias { auditadm_ssh_agent_tmp_t secadm_ssh_agent_tmp_t };
-files_tmp_file(ssh_agent_tmp_t)
-ubac_constrained(ssh_agent_tmp_t)
 
  type ssh_keysign_t;
  type ssh_keysign_exec_t;

policy/modules/services/xserver.te +2 -4

index d2b2626..f51b828 100644
@@ -148,8 +148,7 @@ userdom_user_home_content(xauth_home_t)
  type xauth_tmp_t;
  typealias xauth_tmp_t alias { user_xauth_tmp_t staff_xauth_tmp_t sysadm_xauth_tmp_t };
  typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t };
-files_tmp_file(xauth_tmp_t)
-ubac_constrained(xauth_tmp_t)
+userdom_user_tmp_content(xauth_t, xauth_tmp_t)
 
  # this is not actually a device, its a pipe
  type xconsole_device_t;

@@ -199,8 +198,7 @@ ubac_constrained(xserver_t)
  type xserver_tmp_t;
  typealias xserver_tmp_t alias { user_xserver_tmp_t staff_xserver_tmp_t sysadm_xserver_tmp_t };
  typealias xserver_tmp_t alias { auditadm_xserver_tmp_t secadm_xserver_tmp_t xdm_xserver_tmp_t };
-files_tmp_file(xserver_tmp_t)
-ubac_constrained(xserver_tmp_t)
+userdom_user_tmp_content(xserver_t, xserver_tmp_t)
 
  type xserver_tmpfs_t;
  typealias xserver_tmpfs_t alias { user_xserver_tmpfs_t staff_xserver_tmpfs_t sysadm_xserver_tmpfs_t };

policy/modules/system/userdomain.if +11 -0

index a3135e6..7d83ec3 100644
@@ -1286,6 +1286,30 @@ interface(`userdom_user_home_content',`
 
  ########################################
  ##<summary>
+##	Make the specified type usable user
+##	temporary content.
+##</summary>
+##<param name="domain">
+##	<summary>
+##	Domain using the user temporary
+##	content.
+##	</summary>
+##</param>
+##<param name="file_type">
+##	<summary>

policy/modules/system/userdomain.if +2 -0

+########################################
+##<summary>
  ##	Allow domain to attach to TUN devices created by administrative users.
  ##</summary>
  ##<param name="domain">

policy/modules/system/userdomain.te +1 -0

index 69b2e0f..5dcefd4 100644
@@ -87,6 +87,7 @@ ubac_constrained(user_devpts_t)
  type user_tmp_t alias { staff_tmp_t sysadm_tmp_t secadm_tmp_t auditadm_tmp_t unconfined_tmp_t };
  typealias user_tmp_t alias { staff_untrusted_content_tmp_t sysadm_untrusted_content_tmp_t secadm_untrusted_content_tmp_t auditadm_untrusted_content_tmp_t unconfined_untrusted_content_tmp_t };
  files_tmp_file(user_tmp_t)
+# Consider removing this
  userdom_user_home_content(user_tmp_t)
 
  type user_tmpfs_t alias { staff_tmpfs_t sysadm_tmpfs_t secadm_tmpfs_t auditadm_tmpfs_t unconfined_tmpfs_t };

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 19 lines

########################################
##<summary>

policy/modules/system/userdomain.if +16 -0

+##    Make the specified type usable user
+##    temporary content.
+##</summary>
+##<param name="domain">
+##    <summary>
+##    Domain using the user temporary
+##    content.
+##    </summary>
+##</param>
+##<param name="file_type">
+##    <summary>
+##    Type to be used for user temporary
+##    content.
+##    </summary>
+##</param>
+#

policy/modules/system/userdomain.if interface(`userdom_user_home_content',` · line 1309

Quoted 5 lines

policy/modules/system/userdomain.if +5 -0

+interface(`userdom_user_tmp_content',`
+    files_tmp_file($2)
+    files_poly_member_tmp($1, $2)
+    ubac_constrained($2)
+')

Why do we have files_poly_member_tmp()? I didn't see any places where it was removed above.

Quoted 4 lines

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

On 07/12/2010 08:09 PM, Christopher J. PeBenito wrote:
<snip>

Quoted 19 lines

Quoted 19 lines

   ########################################
   ##<summary>

(quoted diff) +16 -0

+##    Make the specified type usable user
+##    temporary content.
+##</summary>
+##<param name="domain">
+##<summary>
+##    Domain using the user temporary
+##    content.
+##</summary>
+##</param>
+##<param name="file_type">
+##<summary>
+##    Type to be used for user temporary
+##    content.
+##</summary>
+##</param>
+#

Quoted 8 lines

policy/modules/system/userdomain.if interface(`userdom_user_home_content',` · line 1309

Quoted 5 lines

policy/modules/system/userdomain.if +5 -0

+interface(`userdom_user_tmp_content',`
+    files_tmp_file($2)
+    files_poly_member_tmp($1, $2)
+    ubac_constrained($2)
+')

Why do we have files_poly_member_tmp()? I didn't see any places where it was removed above.

I guess there aren't any in refpolicy (except userdom_manage_tmp_role). Does that mean there should not be any?